I have genereted two equal session keys on client and server successfully. But I couldn't understand how each other should validate that they have same session keys.
On the client I generated a SHA1 hash with equation p = SHA1(A | B | S) where A and B are public keys of client and server and S is the SHA1 hash of the session key. Then I sent this hash without any encryption to the server.
Server then calculates p with its own hash of session key and compare with the incoming one.
Is that the supposed way of validating keys in SRP ?
And while client is connecting to other server in cluster, what is the best way to authenticate connection ?
